Bump the cargo-dependencies group across 1 directory with 29 updates by dependabot[bot] · Pull Request #755 · fastly/Viceroy

dependabot · 2026-10-27T22:14:18Z

Bumps the cargo-dependencies group with 29 updates in the / directory:

Package	From	To
http	`0.2.12`	`1.5.0`
http-body	`0.4.6`	`1.1.0`
proptest-derive	`0.8.0`	`0.9.0`
base64	`0.21.7`	`0.23.1`
hyper	`0.14.26`	`1.12.0`
rustls-pemfile	`1.0.4`	`2.2.0`
tokio-rustls	`0.24.1`	`0.26.6`
wasmtime-wasi	`46.0.3`	`48.0.7`
wasmtime-wasi-io	`46.0.3`	`48.0.7`
wasmtime-wasi-nn	`46.0.3`	`48.0.7`
wiggle	`46.0.3`	`48.0.7`
wat	`1.251.0`	`1.262.0`
wasmparser	`0.251.0`	`0.262.0`
wasm-encoder	`0.251.0`	`0.262.0`
wit-component	`0.251.0`	`0.254.2`
wasm-metadata	`0.251.0`	`0.254.2`
tls-listener	`0.7.0`	`0.8.0`
bitflags	`1.3.2`	`2.13.2`
hex-literal	`0.4.1`	`1.1.0`
sha2	`0.10.9`	`0.11.1`
cap-primitives	`3.4.6`	`4.0.3`
h2	`0.3.27`	`0.4.20`
io-extras	`0.18.4`	`0.19.0`
openvino	`0.9.1`	`0.11.1`
openvino-finder	`0.9.1`	`0.11.1`
openvino-sys	`0.9.1`	`0.11.1`
socket2	`0.4.10`	`0.5.10`
wiggle-generate	`46.0.3`	`48.0.7`
wiggle-macro	`46.0.3`	`48.0.7`

Updates http from 0.2.12 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

feat(method): add QUERY method by @seanmonstar in hyperium/http#798

fix(uri): allow empty paths in uri::Builder by @seanmonstar in hyperium/http#853

perf(header,uri): faster value validation, URI parse/format, map inserts by @geeknoid in hyperium/http#852

fix(uri): enforce max length in PathAndQuery by @seanmonstar in hyperium/http#856

New Contributors

@geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

v1.4.2

What's Changed

feat(method): impl PartialOrd + Ord by @mmirate in hyperium/http#840

fix(uri): allow STAR paths with scheme/auth by @seanmonstar in hyperium/http#843

fix: reject DEL character by @Isvane in hyperium/http#842

New Contributors

@mmirate made their first contribution in hyperium/http#840

@Isvane made their first contribution in hyperium/http#842

Full Changelog: hyperium/http@v1.4.1...v1.4.2

v1.4.1

tl;dr

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

What's Changed

chore(header): fix clippy::assign_op_pattern by @rxc-amzn in hyperium/http#806

ci: pin itoa in msrv job by @seanmonstar in hyperium/http#813

Remove unnecessary explicit lifetimes by @jplatte in hyperium/http#815

chore(ci): update to actions/checkout@v6 by @tottoto in hyperium/http#819

tests: update to rand 0.10 by @tottoto in hyperium/http#818

refactor: Remove usage of float instruction by @AurelienFT in hyperium/http#823

refactor(uri): consolidate PathAndQuery::from_shared and from_static by @seanmonstar in hyperium/http#825

fix(uri): reject Path::from_shared/from_static if doesn't start with slash by @seanmonstar in hyperium/http#826

Rephrase comment by @daalfox in hyperium/http#827

Fix typo in request builder docs by @vleksis in hyperium/http#831

fix: clamp Extend size hint so HeaderMap reserve cannot overflow by @SAY-5 in hyperium/http#833

fix(headers): fix stacked borrows for IterMut/ValuesIterMut by @seanmonstar in hyperium/http#837

fix(header): use a set_len guard in IntoIter drop by @seanmonstar in hyperium/http#838

New Contributors

@rxc-amzn made their first contribution in hyperium/http#806

@AurelienFT made their first contribution in hyperium/http#823

... (truncated)

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

Add Method::QUERY constant for the new QUERY method defined in RFC 10008.

Fix uri::Builder::path_and_query() to allow empty strings to mean no path.

Fix uri::PathAndQuery parsing to enforce URI max length.

1.4.2 (June 8, 2026)

Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.

Fix Uri to properly reject DEL characters.

1.4.1 (May 25, 2026)

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

1.4.0 (November 24, 2025)

Add StatusCode::EARLY_HINTS constant for 103 Early Hints.

Make StatusCode::from_u16 now a const fn.

Make Authority::from_static now a const fn.

Make PathAndQuery::from_static now a const fn.

MSRV increased to 1.57 (allows legible const fn panic messages).

1.3.1 (March 11, 2025)

Fix validation that all characters are UTF-8 in URI path and query.

1.3.0 (March 11, 2025)

Allow most UTF-8 characters in URI path and query.

Fix HeaderMap::reserve() to allocate sufficient capacity.

1.2.0 (December 3, 2024)

Add StatusCode::TOO_EARLY constant for 425 status.

Loosen TryFrom<HashMap> for HeaderMap to work with any state generic.

Change Builder methods to use TryInto instead of TryFrom arguments.

Make StatusCode::as_u16 a const function.

Fix Method parsing to allow #$%&' characters.

Fix HeaderName parsing to reject " characters.

Fix off by 1 error in Method::from_bytes that could cause extra allocations.

1.1.0 (March 4, 2024)

Add methods to allow trying to allocate in the HeaderMap, returning an error if oversize instead of panicking.

Add Extensions::get_or_insert() method.

Implement From<Uri> for uri::Builder.

... (truncated)

Commits

16fc9a7 v1.5.0
e559023 fix(uri): enforce max length in PathAndQuery (#856)
2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
bb8705b feat(method): add QUERY method (#798)
82db5b8 v1.4.2
a9cdbf8 fix(uri): reject DEL character (#842)
df75ca3 fix(uri): allow STAR paths with scheme/auth (#843)
ec3f8ce feat(method): impl PartialOrd + Ord (#840)
a24c968 v1.4.1
Additional commits viewable in compare view

Updates http-body from 0.4.6 to 1.1.0

Commits

3396328 http-body v1.1.0
2fb78de chore: bump license year (#170)
b16554b chore(ci): bump checkout to v7
c0c53ca chore(ci): use msrv aware update for msrv job
5ed15d2 tests: fix clippy::double_parens
c8cb37f Derive Copy trait to SizeHint struct (#164)
915d6d5 feat(util): add InspectErr, InspectFrame combinators (#161)
0fc0a94 docs: fix broken intradoc links (#162)
5a849d4 chore: add FUNDING.yml
1a91851 feat: impl Add for SizeHint's (#156)
Additional commits viewable in compare view

Updates proptest-derive from 0.8.0 to 0.9.0

Commits

70cf37d Merge pull request #675 from proptest-rs/prep-1.12
729e0ff prepare next releases and fix panic handling
28c1fad Merge pull request #664 from Expyron/main
5ddd9a4 Merge pull request #668 from toddATavail/fix-fork-persisted-failure
a6a9ac7 Merge pull request #673 from glaziermag/fix-book-deploy
d57d88b Replace rand_chacha with chacha20
9411213 Deploy the book on pushes to main
1719745 fix: terminate the fork replay when a persisted failure fails
0f55b7a test: a persisted failure in a forked test must be reported
4b0594e Merge pull request #669 from proptest-rs/no-fail-fast
Additional commits viewable in compare view

Updates base64 from 0.21.7 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

Make the tests build again on non-SIMD architectures

0.23.0

Added more consts for preconfigured configs and engines

Make DecodeError::InvalidLastSymbol more clear by including the decoded value

Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.

Update MSRV to 1.71.0

Add support for custom padding symbols

0.22.1

Correct the symbols used for the predefined alphabet::BIN_HEX.

0.22.0

DecodeSliceError::OutputSliceTooSmall is now conservative rather than precise. That is, the error will only occur if the decoded output cannot fit, meaning that Engine::decode_slice can now be used with exactly-sized output slices. As part of this, Engine::internal_decode now returns DecodeSliceError instead of DecodeError, but that is not expected to affect any external callers.

DecodeError::InvalidLength now refers specifically to the number of valid symbols being invalid (i.e. len % 4 == 1), rather than just the number of input bytes. This avoids confusing scenarios when based on interpretation you could make a case for either InvalidLength or InvalidByte being appropriate.

Decoding is somewhat faster (5-10%)

Commits

069bf70 v0.23.1
6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
7cffce6 Fix testing on architectures without unsafe SIMD support
e34f9a0 Merge pull request #308 from atouchet/com
e9240c9 Remove outdated comment
9e9220a v0.23.0
870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
fbec5f1 Document no trailing trailing bits
0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
f10b7e2 Update deps & edition
Additional commits viewable in compare view

Updates hyper from 0.14.26 to 1.12.0

Release notes

Sourced from hyper's releases.

v1.12.0

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Everything

docs: fix typo responsibile -> responsible by @vaibhav8a in hyperium/hyper#4177

style: replace single-character lifetime names with descriptive names by @dox4 in hyperium/hyper#4173

refactor(http1): resolve collapsible_match lint by @nakaryo716 in hyperium/hyper#4178

hyper Improvement Proposals by @seanmonstar in hyperium/hyper#4131

perf(body): simpler custom Incoming channel by @seanmonstar in hyperium/hyper#4168

docs(maintainers): add 0x676e67 as a collaborator by @seanmonstar in hyperium/hyper#4184

fix(ext): remove broken OriginalHeaderOrder doctest by @cratelyn in hyperium/hyper#4188

build(deps): remove unused futures-channel from http1 feature by @0x676e67 in hyperium/hyper#4185

chore(ci): update to cargo-check-external-types 0.5.0 by @tottoto in hyperium/hyper#4189

style(lib): address ignored_unit_patterns lint by @nakaryo716 in hyperium/hyper#4193

Preserve hop-by-hop when setting close or keep-alive by @dtolnay in hyperium/hyper#4196

fix(http2): do not reserve capacity for idle Upgraded streams by @Dev-next-gen in hyperium/hyper#4198

style(lib): Address clippy panics and missing_panics_doc lints by @Siech0 in hyperium/hyper#4191

docs: fix typos in capi README, MSRV and governance docs by @toyeshhm in hyperium/hyper#4204

style(lib): Address trivial, low quantity clippy lints. by @Siech0 in hyperium/hyper#4190

chore(clippy): allow clippy lints following 1.99.0 release by @dswij in hyperium/hyper#4219

style: remove useless_borrows_in_formatting from the clippy allowlist by @ump45nose in hyperium/hyper#4220

style(h1): mark partial Debug impls as non-exhaustive by @badimalex in hyperium/hyper#4218

style(lib): Address cast-possible-truncation clippy findings. by @Siech0 in hyperium/hyper#4192

feat(http1): add max_header_size limit for server and client by @Aditya-9-6 in hyperium/hyper#4183

fix(http1): let a Connection close token win over a later keep-alive by @shoemoney in hyperium/hyper#4201

fix(http1): always remove content-length if transfer-encoding is sent by @seanmonstar in hyperium/hyper#4223

fix(http1): remove invalid content-length if transfer-encoding is auto-added by @seanmonstar in hyperium/hyper#4224

fix(http1): withdraw a stale want when the client dispatcher takes a request by @shodoco in hyperium/hyper#4208

perf(body): skip waking a closed peer when a channel end drops by @0x676e67 in hyperium/hyper#4225

Prepare v1.12.0 by @seanmonstar in hyperium/hyper#4226

New Contributors

@vaibhav8a made their first contribution in hyperium/hyper#4177

@dox4 made their first contribution in hyperium/hyper#4173

@dtolnay made their first contribution in hyperium/hyper#4196

@Dev-next-gen made their first contribution in hyperium/hyper#4198

@Siech0 made their first contribution in hyperium/hyper#4191

@toyeshhm made their first contribution in hyperium/hyper#4204

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.12.0 (2026-10-06)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

v1.11.1 (2026-08-27)

Bug Fixes

http1:

detect TE: trailers caselessly and with other values (#4152) (72fcf545)

recognize \n\r\n as a head terminator in the partial-read fast path (#4147) (3534d75c, closes #4145)

flush bytes buffered by the write re-check before yielding (#4143) (f660f5bf)

evict pooled conn on request-side Connection: close (#4110) (da19be08)

v1.11.0 (2026-07-20)

Bug Fixes

http1:

discard content-length header when received before transfer-encoding (#4124) (540fff91, closes #4123)

use append for repeat trailer values in encoder (#4118) (de1483d7)

allow up to max_headers trailers (#4108) (f584091a)

use append for repeat trailers (#4107) (876effe1)

flush buffered data before shutdown (#4018) (72046cc7, closes #4022)

more strictly enforce max_buf_size when parsing (#4093) (90ede307, closes #4081)

http2: avoid buffering Upgraded writes without send capacity (#4102) (aecf5abf)

Features

rt: add ReadBufCursor::initialized_unfilled() method (#4115) (ccc1e850)

... (truncated)

Commits

7f67699 v1.12.0
254bf12 perf(body): skip waking a closed peer when a channel end drops (#4225)
c44f1cc fix(http1): withdraw a stale want when the client dispatcher takes a request ...
69396fd fix(http1): remove content-length if transfer-encoding is auto-added (#4224)
a5d7fd7 fix(http1): always remove content-length if transfer-encoding is sent (#4223)
5dadff7 fix(http1): let a Connection close token win over a later keep-alive (#4201)
d1cd14e feat(http1): add max_header_size limit for server and client (#4183)
714c7cf style(lib): address cast-possible-truncation clippy findings (#4192)
0d47440 style(lib): mark partial Debug impls as non-exhaustive (#4218)
da3b1b1 style(lib): remove useless_borrows_in_formatting from the clippy allowlist (#...
Additional commits viewable in compare view

Updates rustls-pemfile from 1.0.4 to 2.2.0

Release notes

Sourced from rustls-pemfile's releases.

2.2.0

Release notes

The main function of this crate has been incorporated into rustls-pki-types. 2.2.0 maintains the existing public API for this crate, on top of this new implementation. This drops the dependency on the base64 crate, and allows for constant-time decoding of private keys.

This crate will continue to exist in its current form, but it is somewhat unlikely that the API will be extended from its current state.

Should you wish to migrate to using the new rustls-pki-types PEM APIs directly, here is a rough cheat-sheet:

Use case Replace

File stream to CertificateDer iterator rustls_pemfile::certs(io::BufRead) ➡️ CertificateDer::pem_reader_iter(io::Read)

File stream to one PrivateKeyDer rustls_pemfile::private_key(io::BufRead) ➡️ PrivateKeyDer::from_pem_reader(io::Read)

File stream to one CertificateSigningRequestDer rustls_pemfile::csr(io::BufRead) ➡️ CertificateSigningRequestDer::from_pem_reader(io::Read)

File stream to CertificateRevocationListDer iterator rustls_pemfile::crls(io::BufRead) ➡️ CertificateRevocationListDer::pem_reader_iter(io::Read)

File stream to PrivatePkcs1KeyDer iterator rustls_pemfile::rsa_private_keys(io::BufRead) ➡️ PrivatePkcs1KeyDer::pem_reader_iter(io::Read)

File stream to PrivatePkcs8KeyDer iterator rustls_pemfile::pkcs8_private_keys(io::BufRead) ➡️ PrivatePkcs8KeyDer::pem_reader_iter(io::Read)

File stream to PrivateSec1KeyDer iterator rustls_pemfile::ec_private_keys(io::BufRead) ➡️ PrivateSec1KeyDer::pem_reader_iter(io::Read)

File stream to SubjectPublicKeyInfoDer iterator rustls_pemfile::public_keys(io::BufRead) ➡️ SubjectPublicKeyInfoDer::pem_reader_iter(io::Read)

What's Changed

Add semver checks action by @ctz in rustls/pemfile#54

Use pki-types pem decoding by @ctz in rustls/pemfile#55

Prepare 2.2.0 by @ctz in rustls/pemfile#56

Full Changelog: rustls/pemfile@v/2.1.3...v/2.2.0

2.1.3

Notable changes

Added support for raw public keys (see rustls/pemfile#51).

What's Changed

ci: add scheduled build, use ubuntu-latest by @cpu in rustls/pemfile#47

Bump base64 from 0.22.0 to 0.22.1 by @dependabot in rustls/pemfile#49

Read Public Keys from a pemfile by @holodorum in rustls/pemfile#51

2.1.2

Dependency updates.

What's Changed

Bump base64 from 0.21.5 to 0.22.0 by @dependabot in rustls/pemfile#44

Cargo: version 2.1.1 -> 2.1.2 by @alex in rustls/pemfile#45

Delete obsolete release history section by @ctz in rustls/pemfile#46

New Contributors

@alex made their first contribution in rustls/pemfile#45

... (truncated)

Commits

0f37efe Prepare 2.2.0
f5d49b2 rustfmt to reformat imports
7bbc08e Use pki-types 1.9 for PEM decoding
b2104d8 Add semver checks action
38c6f8b Add RawPublicKeyCertificate
5d9960f Bump pki-types from 1.3 to 1.7 and version from
bd9773d Bump base64 from 0.22.0 to 0.22.1
e4f1fae ci: add cron schedule trigger
2433110 ci: switch linux hosts to ubuntu-latest
7ba4ab7 Delete obsolete release history section
Additional commits viewable in compare view

Updates tokio-rustls from 0.24.1 to 0.26.6

Release notes

Sourced from tokio-rustls's releases.

0.26.6

0.26.5 added an optimization to batch multiple reads which could swallow some errors. Buffer errors so that they propagate to the caller as soon as the caller next reads from the stream.

What's Changed

Buffer and propagate errors from transport by @dtolnay in rustls/tokio-rustls#205

Prepare 0.26.6 by @djc in rustls/tokio-rustls#206

0.26.5

What's Changed

Exclude bad test keys from the published package by @weiznich in rustls/tokio-rustls#140

chore: improve code comments clarity by @xibeiyoumian in rustls/tokio-rustls#152

client/server timeout examples, doc pass hinting towards timeouts. by @cpu in rustls/tokio-rustls#187

return more data at once from TlsStream::poll_read by @trinity-1686a in rustls/tokio-rustls#198

0.26.4

What's Changed

Add TLS certificate compression features by @manifest in rustls/tokio-rustls#130

0.26.3

What's Changed

Clarify how to run the example server by @sundresh in rustls/tokio-rustls#111

fix: handshake does not fully flush writes by @conradludgate in rustls/tokio-rustls#112

feat: add alpn_protocols for TlsConnector::connect_with by @yukiiiteru in rustls/tokio-rustls#116

lib: derive Debug on StartHandshake by @lucab in rustls/tokio-rustls#120

server: allow splitting and reassembling a StartHandshake by @lucab in rustls/tokio-rustls#127

Make StartHandshake fields public by @djc in rustls/tokio-rustls#128

0.26.2

What's Changed

Cargo: MSRV 1.70 -> 1.71 by @cpu in rustls/tokio-rustls#101

Implement AsyncBufRead by @goffrie in rustls/tokio-rustls#100

feat: add access to underlying config by @sunng87 in rustls/tokio-rustls#103

release 0.26.2 by @quininer in rustls/tokio-rustls#104

0.26.1

What's Changed

Change: make license spdx compliant by @jjnicola in rustls/tokio-rustls#62

Fix test regression after rustls improvements in complete_io() by @djc in rustls/tokio-rustls#68

must use rustls 0.23.5 by @quininer in rustls/tokio-rustls#69

Check-in Cargo.lock, fix MSRV build by @cpu in rustls/tokio-rustls#78

examples: prefer pemfile::private_key by @cpu in rustls/tokio-rustls#77

tests: rework vendored certificates/keys by @cpu in rustls/tokio-rustls#80

Use new rustls-pki-types PEM API by @djc in rustls/tokio-rustls#87

fix: return write-zero error when write return 0 by @quininer in rustls/tokio-rustls#93

... (truncated)

Commits

8aebb7c Bump version to 0.26.6
6f8509a Rename buffered_err to error
bd0494d Buffer and propagate errors from transport
a781340 Add regression test for issue 204
9d0dae6 build(deps): bump rustls from 0.23.44 to 0.23.45
0ad049e build(deps): bump rustls from 0.23.43 to 0.23.44
4f913c7 build(deps): bump rcgen from 0.14.9 to 0.14.10
f8832d2 Bump version to 0.26.5
c0fad2f return more data at once from TlsStream::poll_read (#198)
edc7306 build(deps): bump futures-util from 0.3.33 to 0.3.34
Additional commits viewable in compare view

Updates wasmtime-wasi from 46.0.3 to 48.0.7

Release notes

Sourced from wasmtime-wasi's releases.

v48.0.7

48.0.7

Released 2026-10-19.

Fixed

wasi-http: Guests can add conflicting content lengths to messages GHSA-r8xh-cgf7-392j

wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hook GHSA-jxcf-8qw5-5c33

wasi-http p3: Guests can set incorrect content-length for spliced response bodies GHSA-9prg-84vf-g5fc

Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction GHSA-mghf-wjfp-p5xm

Update rustls to 0.23.46 #14768

Panic lowering a host-created component model stream into a guest that expects a different payload type. GHSA-9pvw-hwfg-92h5

v48.0.6

48.0.6

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

... (truncated)

Changelog

Sourced from wasmtime-wasi's changelog.

48.0.7

Released 2026-10-19.

Fixed

wasi-http: Guests can add conflicting content lengths to messages GHSA-r8xh-cgf7-392j

wasi-http p3: forwarded trailers aren't checked against is_forbidden_header hook GHSA-jxcf-8qw5-5c33

wasi-http p3: Guests can set incorrect content-length for spliced response bodies GHSA-9prg-84vf-g5fc

Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction GHSA-mghf-wjfp-p5xm

Update rustls to 0.23.46 #14768

Panic lowering a host-created component model stream into a guest that expects a different payload type. GHSA-9pvw-hwfg-92h5

48.0.6

Released 2026-10-14.

Fixed

Out-of-bounds zero-length stream writes can panic. GHSA-93g3-36p8-x2gc

Host panic when component call_async is cancelled under some conditions. GHSA-3r89-v5mq-j5xf

Panic on erroneous call-to-host from guest realloc call. GHSA-7v24-42x9-pxf7

Yielding in a component start function can lead to a host panic. GHSA-5hhx-4wrr-3j9g

Panic when invoking an async-lifted function via call. GHSA-m6w2-jwq2-cv2c

Panic when pending calls are run after a trap. GHSA-hmwq-g22x-qjw5

Stack overflow dropping a long chain of recursive types. GHSA-wjc8-633q-pwxr

Wasmtime may not properly enforce async-entrypoint requirement. GHSA-vcg5-q8m5-8379

... (truncated)

Commits

c6846e1 Release Wasmtime 48.0.7 (#14817)
222ff3a Security Fixes for 48.0.7 (#14819)
f54bba0 [release-48] update rustls to 0.23.46 (#14768)
72bc45b Release Wasmtime 48.0.6 (#14723)
67ecb49 [48.0.x] Combined backports for today's security release (#14720)
563544c Release Wasmtime 48.0.5 (#14495)
3b24fed Update logic for finding the run for a release (#14494)
8ca73ad Fix a flaky test failure (

Bumps the cargo-dependencies group with 29 updates in the / directory: | Package | From | To | | --- | --- | --- | | [http](https://github.com/hyperium/http) | `0.2.12` | `1.5.0` | | [http-body](https://github.com/hyperium/http-body) | `0.4.6` | `1.1.0` | | [proptest-derive](https://github.com/proptest-rs/proptest) | `0.8.0` | `0.9.0` | | [base64](https://github.com/marshallpierce/rust-base64) | `0.21.7` | `0.23.1` | | [hyper](https://github.com/hyperium/hyper) | `0.14.26` | `1.12.0` | | [rustls-pemfile](https://github.com/rustls/pemfile) | `1.0.4` | `2.2.0` | | [tokio-rustls](https://github.com/rustls/tokio-rustls) | `0.24.1` | `0.26.6` | | [wasmtime-wasi](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | | [wasmtime-wasi-io](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | | [wasmtime-wasi-nn](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | | [wiggle](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | | [wat](https://github.com/bytecodealliance/wasm-tools) | `1.251.0` | `1.262.0` | | [wasmparser](https://github.com/bytecodealliance/wasm-tools) | `0.251.0` | `0.262.0` | | [wasm-encoder](https://github.com/bytecodealliance/wasm-tools) | `0.251.0` | `0.262.0` | | [wit-component](https://github.com/bytecodealliance/wasm-tools) | `0.251.0` | `0.254.2` | | [wasm-metadata](https://github.com/bytecodealliance/wasm-tools) | `0.251.0` | `0.254.2` | | [tls-listener](https://github.com/tmccombs/tls-listener) | `0.7.0` | `0.8.0` | | [bitflags](https://github.com/bitflags/bitflags) | `1.3.2` | `2.13.2` | | [hex-literal](https://github.com/RustCrypto/utils) | `0.4.1` | `1.1.0` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.1` | | [cap-primitives](https://github.com/bytecodealliance/cap-std) | `3.4.6` | `4.0.3` | | [h2](https://github.com/hyperium/h2) | `0.3.27` | `0.4.20` | | [io-extras](https://github.com/sunfishcode/io-extras) | `0.18.4` | `0.19.0` | | [openvino](https://github.com/intel/openvino-rs) | `0.9.1` | `0.11.1` | | [openvino-finder](https://github.com/intel/openvino-rs) | `0.9.1` | `0.11.1` | | [openvino-sys](https://github.com/intel/openvino-rs) | `0.9.1` | `0.11.1` | | [socket2](https://github.com/rust-lang/socket2) | `0.4.10` | `0.5.10` | | [wiggle-generate](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | | [wiggle-macro](https://github.com/bytecodealliance/wasmtime) | `46.0.3` | `48.0.7` | Updates `http` from 0.2.12 to 1.5.0 - [Release notes](https://github.com/hyperium/http/releases) - [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md) - [Commits](hyperium/http@v0.2.12...v1.5.0) Updates `http-body` from 0.4.6 to 1.1.0 - [Release notes](https://github.com/hyperium/http-body/releases) - [Commits](hyperium/http-body@v0.4.6...v1.1.0) Updates `proptest-derive` from 0.8.0 to 0.9.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](proptest-rs/proptest@proptest-derive-0.8.0...proptest-derive-0.9.0) Updates `base64` from 0.21.7 to 0.23.1 - [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md) - [Commits](marshallpierce/rust-base64@v0.21.7...v0.23.1) Updates `hyper` from 0.14.26 to 1.12.0 - [Release notes](https://github.com/hyperium/hyper/releases) - [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md) - [Commits](hyperium/hyper@v0.14.26...v1.12.0) Updates `rustls-pemfile` from 1.0.4 to 2.2.0 - [Release notes](https://github.com/rustls/pemfile/releases) - [Commits](rustls/pemfile@v/1.0.4...v/2.2.0) Updates `tokio-rustls` from 0.24.1 to 0.26.6 - [Release notes](https://github.com/rustls/tokio-rustls/releases) - [Commits](rustls/tokio-rustls@v/0.24.1...v/0.26.6) Updates `wasmtime-wasi` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) Updates `wasmtime-wasi-io` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) Updates `wasmtime-wasi-nn` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) Updates `wiggle` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) Updates `wat` from 1.251.0 to 1.262.0 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](bytecodealliance/wasm-tools@v1.251.0...v1.262.0) Updates `wasmparser` from 0.251.0 to 0.262.0 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) Updates `wasm-encoder` from 0.251.0 to 0.262.0 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) Updates `wit-component` from 0.251.0 to 0.254.2 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) Updates `wasm-metadata` from 0.251.0 to 0.254.2 - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) Updates `tls-listener` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/tmccombs/tls-listener/releases) - [Changelog](https://github.com/tmccombs/tls-listener/blob/main/CHANGELOG.md) - [Commits](tmccombs/tls-listener@v0.7.0...v0.8.0) Updates `bitflags` from 1.3.2 to 2.13.2 - [Release notes](https://github.com/bitflags/bitflags/releases) - [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md) - [Commits](bitflags/bitflags@1.3.2...2.13.2) Updates `hex-literal` from 0.4.1 to 1.1.0 - [Commits](RustCrypto/utils@hex-literal-v0.4.1...hex-literal-v1.1.0) Updates `sha2` from 0.10.9 to 0.11.1 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.1) Updates `cap-primitives` from 3.4.6 to 4.0.3 - [Commits](sunfishcode/cap-std@cap-primitives-v3.4.6...cap-primitives-v4.0.3) Updates `h2` from 0.3.27 to 0.4.20 - [Release notes](https://github.com/hyperium/h2/releases) - [Changelog](https://github.com/hyperium/h2/blob/master/CHANGELOG.md) - [Commits](hyperium/h2@v0.3.27...v0.4.20) Updates `io-extras` from 0.18.4 to 0.19.0 - [Commits](sunfishcode/io-extras@v0.18.4...v0.19.0) Updates `openvino` from 0.9.1 to 0.11.1 - [Release notes](https://github.com/intel/openvino-rs/releases) - [Commits](intel/openvino-rs@v0.9.1...v0.11.1) Updates `openvino-finder` from 0.9.1 to 0.11.1 - [Release notes](https://github.com/intel/openvino-rs/releases) - [Commits](intel/openvino-rs@v0.9.1...v0.11.1) Updates `openvino-sys` from 0.9.1 to 0.11.1 - [Release notes](https://github.com/intel/openvino-rs/releases) - [Commits](intel/openvino-rs@v0.9.1...v0.11.1) Updates `socket2` from 0.4.10 to 0.5.10 - [Release notes](https://github.com/rust-lang/socket2/releases) - [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/socket2/commits) Updates `wiggle-generate` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) Updates `wiggle-macro` from 46.0.3 to 48.0.7 - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v46.0.3...v48.0.7) --- updated-dependencies: - dependency-name: http dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: http-body dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: proptest-derive dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: base64 dependency-version: 0.23.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: hyper dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: rustls-pemfile dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: tokio-rustls dependency-version: 0.26.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wasmtime-wasi dependency-version: 48.0.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: wasmtime-wasi-io dependency-version: 48.0.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: wasmtime-wasi-nn dependency-version: 48.0.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: wiggle dependency-version: 48.0.7 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: wat dependency-version: 1.262.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wasmparser dependency-version: 0.262.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wasm-encoder dependency-version: 0.262.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wit-component dependency-version: 0.254.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wasm-metadata dependency-version: 0.254.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: tls-listener dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: bitflags dependency-version: 2.13.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: hex-literal dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: sha2 dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: cap-primitives dependency-version: 4.0.3 dependency-type: indirect update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: h2 dependency-version: 0.4.20 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: io-extras dependency-version: 0.19.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: openvino dependency-version: 0.11.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: openvino-finder dependency-version: 0.11.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: openvino-sys dependency-version: 0.11.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: socket2 dependency-version: 0.5.10 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: wiggle-generate dependency-version: 48.0.7 dependency-type: indirect update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: wiggle-macro dependency-version: 48.0.7 dependency-type: indirect update-type: version-update:semver-major dependency-group: cargo-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-11-02T19:07:42Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the skip-changelog This change does not require a changelog entry. label Oct 27, 2026

dependabot Bot requested a review from a team as a code owner October 27, 2026 22:14

dependabot Bot closed this Nov 2, 2026

dependabot Bot deleted the dependabot/cargo/cargo-dependencies-19e92c2900 branch November 2, 2026 19:07

Navigation Menu

Repository navigation

Bump the cargo-dependencies group across 1 directory with 29 updates - #755

Bump the cargo-dependencies group across 1 directory with 29 updates#755
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-19e92c2900

dependabot Bot commented on behalf of github Oct 27, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Use case	Replace
File stream to `CertificateDer` iterator	`rustls_pemfile::certs(io::BufRead)` ➡️ `CertificateDer::pem_reader_iter(io::Read)`
File stream to one `PrivateKeyDer`	`rustls_pemfile::private_key(io::BufRead)` ➡️ `PrivateKeyDer::from_pem_reader(io::Read)`
File stream to one `CertificateSigningRequestDer`	`rustls_pemfile::csr(io::BufRead)` ➡️ `CertificateSigningRequestDer::from_pem_reader(io::Read)`
File stream to `CertificateRevocationListDer` iterator	`rustls_pemfile::crls(io::BufRead)` ➡️ `CertificateRevocationListDer::pem_reader_iter(io::Read)`
File stream to `PrivatePkcs1KeyDer` iterator	`rustls_pemfile::rsa_private_keys(io::BufRead)` ➡️ `PrivatePkcs1KeyDer::pem_reader_iter(io::Read)`
File stream to `PrivatePkcs8KeyDer` iterator	`rustls_pemfile::pkcs8_private_keys(io::BufRead)` ➡️ `PrivatePkcs8KeyDer::pem_reader_iter(io::Read)`
File stream to `PrivateSec1KeyDer` iterator	`rustls_pemfile::ec_private_keys(io::BufRead)` ➡️ `PrivateSec1KeyDer::pem_reader_iter(io::Read)`
File stream to `SubjectPublicKeyInfoDer` iterator	`rustls_pemfile::public_keys(io::BufRead)` ➡️ `SubjectPublicKeyInfoDer::pem_reader_iter(io::Read)`

Conversation

dependabot Bot commented on behalf of github Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.5.0

What's Changed

New Contributors

v1.4.2

What's Changed

New Contributors

v1.4.1

tl;dr

What's Changed

New Contributors

1.5.0 (July 29, 2026)

1.4.2 (June 8, 2026)

1.4.1 (May 25, 2026)

1.4.0 (November 24, 2025)

1.3.1 (March 11, 2025)

1.3.0 (March 11, 2025)

1.2.0 (December 3, 2024)

1.1.0 (March 4, 2024)

0.23.1

0.23.0

0.22.1

0.22.0

v1.12.0

Features

Bug Fixes

Everything

New Contributors

v1.12.0 (2026-10-06)

Bug Fixes

Features

v1.11.1 (2026-08-27)

Bug Fixes

v1.11.0 (2026-07-20)

Bug Fixes

Features

2.2.0

Release notes

What's Changed

2.1.3

Notable changes

What's Changed

2.1.2

What's Changed

New Contributors

0.26.6

What's Changed

0.26.5

What's Changed

0.26.4

What's Changed

0.26.3

What's Changed

0.26.2

What's Changed

0.26.1

What's Changed

v48.0.7

48.0.7

Fixed

v48.0.6

48.0.6

Fixed

48.0.7

Fixed

48.0.6

Fixed

Uh oh!

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

dependabot Bot commented on behalf of github Oct 27, 2026 •

edited

Loading